{"id":"https://openalex.org/W7162993931","doi":"https://doi.org/10.48550/arxiv.2605.31042","title":"From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors","display_name":"From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors","publication_year":2026,"publication_date":"2026-05-29","ids":{"openalex":"https://openalex.org/W7162993931","doi":"https://doi.org/10.48550/arxiv.2605.31042"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.31042","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31042","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.31042","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137582017","display_name":"Jiejun Tan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tan, Jiejun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137580009","display_name":"Zhicheng Dou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dou, Zhicheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137599716","display_name":"Xinyu Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Xinyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137588382","display_name":"Yuyang Hu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hu, Yuyang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137611809","display_name":"Yiruo Cheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cheng, Yiruo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137556495","display_name":"Xiaoxi Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Xiaoxi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137528422","display_name":"Ji-Rong Wen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wen, Ji-Rong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9074000120162964,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9074000120162964,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.02280000038444996,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.015200000256299973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trojan","display_name":"Trojan","score":0.7523999810218811},{"id":"https://openalex.org/keywords/blocking","display_name":"Blocking (statistics)","score":0.5584999918937683},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.4632999897003174},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.4586000144481659},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.42170000076293945},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.4196000099182129},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.4117000102996826},{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.36559998989105225}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7785999774932861},{"id":"https://openalex.org/C174333608","wikidata":"https://www.wikidata.org/wiki/Q19635","display_name":"Trojan","level":2,"score":0.7523999810218811},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.692300021648407},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.5584999918937683},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.4632999897003174},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.4586000144481659},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.42170000076293945},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.4196000099182129},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4117000102996826},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.36559998989105225},{"id":"https://openalex.org/C58581272","wikidata":"https://www.wikidata.org/wiki/Q12741163","display_name":"Workspace","level":3,"score":0.34599998593330383},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.3353999853134155},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.32280001044273376},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.31869998574256897},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.305400013923645},{"id":"https://openalex.org/C2775937380","wikidata":"https://www.wikidata.org/wiki/Q1232589","display_name":"Replica","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.29739999771118164},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.2953999936580658},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.2818000018596649},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C112505250","wikidata":"https://www.wikidata.org/wiki/Q787116","display_name":"Automaton","level":2,"score":0.2567000091075897},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.2531000077724457}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.31042","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31042","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.31042","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31042","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5306276679039001,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"LLM":[0,18],"agents":[1],"are":[2],"evolving":[3],"from":[4,199],"conversational":[5],"chatbots":[6],"to":[7,117,137,220],"operational":[8],"tools":[9],"in":[10,103,142,184],"real-world":[11],"workspaces.":[12],"In":[13,70,146],"local":[14,143,186],"agentic":[15,144],"harnesses,":[16],"an":[17,147],"can":[19,47,87,109],"read":[20,60],"and":[21,26,66,191],"write":[22,121],"files,":[23,187],"call":[24],"tools,":[25],"reuse":[27],"workspace":[28,150],"state":[29],"across":[30],"sessions.":[31],"While":[32],"such":[33],"capabilities":[34],"enhance":[35],"utility,":[36],"they":[37,108],"also":[38],"expose":[39],"a":[40,49,53,106,111,134,155,200],"new":[41],"attack":[42,74,157,215],"surface":[43],"for":[44],"attackers.":[45],"Attackers":[46],"embed":[48],"prompt":[50],"injection":[51],"within":[52],"file":[54],"or":[55],"tool":[56],"output.":[57],"Agents":[58],"may":[59],"this":[61,71,129,175],"hidden":[62],"instruction,":[63],"store":[64],"it,":[65],"execute":[67],"it":[68],"later.":[69],"multi-step":[72,139],"trojan":[73,140],"paradigm,":[75],"no":[76],"individual":[77],"step":[78,102],"appears":[79],"malicious":[80],"on":[81,169],"its":[82,189],"own,":[83],"but":[84,115],"these":[85],"steps":[86],"collectively":[88],"turn":[89],"untrusted":[90],"text":[91,183],"into":[92],"persistent":[93],"control":[94,193],"content.":[95],"However,":[96],"existing":[97,162],"defenses":[98],"often":[99],"inspect":[100],"each":[101],"isolation.":[104],"As":[105],"result,":[107],"block":[110],"clear":[112],"harmful":[113],"action,":[114],"fail":[116],"detect":[118],"the":[119,125,170,221],"earlier":[120],"operation":[122],"that":[123,195,206],"plants":[124],"backdoor.":[126],"To":[127,173],"reveal":[128],"threat,":[130,176],"we":[131,177],"introduce":[132],"ClawTrojan,":[133],"benchmark":[135],"designed":[136],"identify":[138],"attacks":[141,165],"harnesses.":[145],"OpenClaw-style":[148],"simulated":[149],"with":[151,217],"GPT-5.4,":[152],"ClawTrojan":[153],"reaches":[154],"95.5%":[156],"success":[158],"rate":[159],"(ASR),":[160],"while":[161],"single-turn":[163],"prompt-injection":[164],"produce":[166],"near-zero":[167],"ASR":[168],"same":[171],"model.":[172],"address":[174],"propose":[178],"DASGuard,":[179],"which":[180],"scans":[181],"control-like":[182],"sensitive":[185],"traces":[188],"origin,":[190],"removes":[192],"content":[194],"does":[196],"not":[197],"originate":[198],"trusted":[201],"source.":[202],"Our":[203],"results":[204],"show":[205],"DASGuard":[207],"achieves":[208],"strong":[209],"dynamic":[210],"defense":[211],"by":[212],"combining":[213],"runtime":[214],"blocking":[216],"sanitized":[218],"commits":[219],"workspace.":[222]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-02T00:00:00"}